The Internet of Things (IoT) is a fast growing field of devices being added to an interconnected environment in an abstract heterogeneous array of servers and devices, called smart environments, ranging from private local environments to nation-wide infrastructures, often accessible via unsecured wireless communications and information technologies, hence, massively open to attacks. In this paper we propose an On-The-Fly One Time Pad (OTP) protocol based upon the Diffie-Hellman key exchange for secure communications between smart devices endowed with low computational capabilities to a home gateway server via unsecured wireless communication channels. Our assumptions are that at setup both a user and the home gateway server have enough processing power to perform - say - secured RSA encrypted communication, hence relaxing the need for a trusted secure server outside the domain, and that the protocol should at least be secure for a range of known attacks, as replay or DoS attacks.